From: Tom Hughes Date: Sun, 1 Mar 2020 19:08:40 +0000 (+0000) Subject: Enforce restrictions on issue visibility properly X-Git-Tag: live~2249 X-Git-Url: https://git.openstreetmap.org/rails.git/commitdiff_plain/06122fc0900cb2d58d3401cfab9aa0c521eef374 Enforce restrictions on issue visibility properly --- diff --git a/app/controllers/issues_controller.rb b/app/controllers/issues_controller.rb index 61f466f62..d136e7230 100644 --- a/app/controllers/issues_controller.rb +++ b/app/controllers/issues_controller.rb @@ -80,6 +80,8 @@ class IssuesController < ApplicationController private def find_issue - @issue = Issue.find(params[:id]) + @issue = Issue.visible_to(current_user).find(params[:id]) + rescue ActiveRecord::RecordNotFound + head :not_found end end diff --git a/test/controllers/issues_controller_test.rb b/test/controllers/issues_controller_test.rb index af0a86028..d16f66455 100644 --- a/test/controllers/issues_controller_test.rb +++ b/test/controllers/issues_controller_test.rb @@ -24,9 +24,9 @@ class IssuesControllerTest < ActionController::TestCase assert_response :success end - def test_show + def test_show_moderator target_user = create(:user) - issue = create(:issue, :reportable => target_user, :reported_user => target_user) + issue = create(:issue, :reportable => target_user, :reported_user => target_user, :assigned_role => "moderator") # Access issue without login get :show, :params => { :id => issue.id } @@ -42,17 +42,43 @@ class IssuesControllerTest < ActionController::TestCase # Access issue as administrator session[:user] = create(:administrator_user).id get :show, :params => { :id => issue.id } + assert_response :not_found + + # Access issue as moderator + session[:user] = create(:moderator_user).id + get :show, :params => { :id => issue.id } assert_response :success + end + + def test_show_administrator + target_user = create(:user) + issue = create(:issue, :reportable => target_user, :reported_user => target_user, :assigned_role => "administrator") + + # Access issue without login + get :show, :params => { :id => issue.id } + assert_response :redirect + assert_redirected_to login_path(:referer => issue_path(issue)) + + # Access issue as normal user + session[:user] = create(:user).id + get :show, :params => { :id => issue.id } + assert_response :redirect + assert_redirected_to :controller => :errors, :action => :forbidden # Access issue as moderator session[:user] = create(:moderator_user).id get :show, :params => { :id => issue.id } + assert_response :not_found + + # Access issue as administrator + session[:user] = create(:administrator_user).id + get :show, :params => { :id => issue.id } assert_response :success end - def test_resolve + def test_resolve_moderator target_user = create(:user) - issue = create(:issue, :reportable => target_user, :reported_user => target_user) + issue = create(:issue, :reportable => target_user, :reported_user => target_user, :assigned_role => "moderator") # Resolve issue without login get :resolve, :params => { :id => issue.id } @@ -68,21 +94,47 @@ class IssuesControllerTest < ActionController::TestCase # Resolve issue as administrator session[:user] = create(:administrator_user).id get :resolve, :params => { :id => issue.id } + assert_response :not_found + assert_equal false, issue.reload.resolved? + + # Resolve issue as moderator + session[:user] = create(:moderator_user).id + get :resolve, :params => { :id => issue.id } assert_response :redirect assert_equal true, issue.reload.resolved? + end - issue.reopen! + def test_resolve_administrator + target_user = create(:user) + issue = create(:issue, :reportable => target_user, :reported_user => target_user, :assigned_role => "administrator") + + # Resolve issue without login + get :resolve, :params => { :id => issue.id } + assert_response :redirect + assert_redirected_to login_path(:referer => resolve_issue_path(issue)) + + # Resolve issue as normal user + session[:user] = create(:user).id + get :resolve, :params => { :id => issue.id } + assert_response :redirect + assert_redirected_to :controller => :errors, :action => :forbidden # Resolve issue as moderator session[:user] = create(:moderator_user).id get :resolve, :params => { :id => issue.id } + assert_response :not_found + assert_equal false, issue.reload.resolved? + + # Resolve issue as administrator + session[:user] = create(:administrator_user).id + get :resolve, :params => { :id => issue.id } assert_response :redirect assert_equal true, issue.reload.resolved? end - def test_ignore + def test_ignore_moderator target_user = create(:user) - issue = create(:issue, :reportable => target_user, :reported_user => target_user) + issue = create(:issue, :reportable => target_user, :reported_user => target_user, :assigned_role => "moderator") # Ignore issue without login get :ignore, :params => { :id => issue.id } @@ -98,21 +150,47 @@ class IssuesControllerTest < ActionController::TestCase # Ignore issue as administrator session[:user] = create(:administrator_user).id get :ignore, :params => { :id => issue.id } + assert_response :not_found + assert_equal false, issue.reload.ignored? + + # Ignore issue as moderator + session[:user] = create(:moderator_user).id + get :ignore, :params => { :id => issue.id } assert_response :redirect assert_equal true, issue.reload.ignored? + end + + def test_ignore_administrator + target_user = create(:user) + issue = create(:issue, :reportable => target_user, :reported_user => target_user, :assigned_role => "administrator") + + # Ignore issue without login + get :ignore, :params => { :id => issue.id } + assert_response :redirect + assert_redirected_to login_path(:referer => ignore_issue_path(issue)) - issue.reopen! + # Ignore issue as normal user + session[:user] = create(:user).id + get :ignore, :params => { :id => issue.id } + assert_response :redirect + assert_redirected_to :controller => :errors, :action => :forbidden # Ignore issue as moderator session[:user] = create(:moderator_user).id get :ignore, :params => { :id => issue.id } + assert_response :not_found + assert_equal false, issue.reload.ignored? + + # Ignore issue as administrator + session[:user] = create(:administrator_user).id + get :ignore, :params => { :id => issue.id } assert_response :redirect assert_equal true, issue.reload.ignored? end - def test_reopen + def test_reopen_moderator target_user = create(:user) - issue = create(:issue, :reportable => target_user, :reported_user => target_user) + issue = create(:issue, :reportable => target_user, :reported_user => target_user, :assigned_role => "moderator") issue.resolve! @@ -130,14 +208,42 @@ class IssuesControllerTest < ActionController::TestCase # Reopen issue as administrator session[:user] = create(:administrator_user).id get :reopen, :params => { :id => issue.id } + assert_response :not_found + assert_equal false, issue.reload.open? + + # Reopen issue as moderator + session[:user] = create(:moderator_user).id + get :reopen, :params => { :id => issue.id } assert_response :redirect assert_equal true, issue.reload.open? + end + + def test_reopen_administrator + target_user = create(:user) + issue = create(:issue, :reportable => target_user, :reported_user => target_user, :assigned_role => "administrator") issue.resolve! + # Reopen issue without login + get :reopen, :params => { :id => issue.id } + assert_response :redirect + assert_redirected_to login_path(:referer => reopen_issue_path(issue)) + + # Reopen issue as normal user + session[:user] = create(:user).id + get :reopen, :params => { :id => issue.id } + assert_response :redirect + assert_redirected_to :controller => :errors, :action => :forbidden + # Reopen issue as moderator session[:user] = create(:moderator_user).id get :reopen, :params => { :id => issue.id } + assert_response :not_found + assert_equal false, issue.reload.open? + + # Reopen issue as administrator + session[:user] = create(:administrator_user).id + get :reopen, :params => { :id => issue.id } assert_response :redirect assert_equal true, issue.reload.open? end diff --git a/test/system/issues_test.rb b/test/system/issues_test.rb index 08b1acb34..ebf1d272a 100644 --- a/test/system/issues_test.rb +++ b/test/system/issues_test.rb @@ -72,7 +72,7 @@ class IssuesTest < ApplicationSystemTestCase end def test_commenting - issue = create(:issue) + issue = create(:issue, :assigned_role => "moderator") sign_in_as(create(:moderator_user)) visit issue_path(issue)